Releases 12.1 

!!! Recommendation: align existing Solr volumes with the new configset 

The ext_solr_12_1_0 configset now sets the Unified Highlighter as default on both the /select and /browse request handlers. Solr volumes created from older configsets default to the legacy highlighter and remain vulnerable to the FieldExistsQuery HTTP 500 oracle when queried directly (bypassing EXT:solr). Run the bundled migration script against the existing configset to align the defaults; the script is idempotent and writes a solrconfig.xml.Backup-SST-235567 backup next to the modified file: * Docker/SolrServer/docker-entrypoint-initdb.d-as-sudo/fix-SST-235567-2026050810000025-highlighter-defaults.sh EXT:solr itself enforces the Unified Highlighter unconditionally in PHP, so this configset alignment is a defence-in-depth measure for clients that query Solr directly.

!!! New: TypoScript settings for query-syntax handling 

Two new TypoScript settings govern how user input on tx_solr[q] is parsed:

• plugin.tx_solr.search.query.userFields — whitelist of fields a Solr field-selector (field:value) may target. By default derived from query.queryFields; selectors against other fields are now treated as literal terms and silently miss. Sites that rely on selectors against non-qf fields must extend the whitelist via a scalar override or the add / remove sub-keys.
• plugin.tx_solr.search.query.allowSolrOperatorSyntax — toggle for operator-syntax passthrough. Default 1 keeps the documented + - && || ! * ? UX functional; set to 0 for strict mode (additionally escapes | & ;). Selector, range and grouping characters (: [ ] ( ) { } ^ " ~ \ /) are always escaped regardless.

See tx_solr.search for full reference details.

!!! Breaking: multi-value cObjs now use JSON transport 

The SOLR_MULTIVALUE, SOLR_RELATION and SOLR_CLASSIFICATION content objects now return their multi-value payload as json_encode($array) instead of serialize($array), and the indexer decodes it with json_decode() instead of unserialize(). Because json_decode() never reconstructs PHP objects, the indexer can no longer be turned into a PHP object-injection sink by an attacker who can influence an indexed record field.

Third-party content objects that returned serialize($array) for a multi-value Solr field must switch to json_encode($array); no other change is required.

!!! Security: additionalFilters can no longer preempt the siteHash filter 

Request-provided tx_solr[additionalFilters] could register a named siteHash filter that AbstractQueryBuilder::useFilter() refused to overwrite, so the system siteHash filter added later by AccessComponent was dropped. In a shared-Solr-core multi-site installation this let an anonymous visitor of one site read public documents of another site sharing the same core (CVE-2026-56094).

EXT:solr now strips the reserved filter names siteHash and access from request-provided additionalFilters before they reach the query, and applies the system siteHash filter with remove-then-set semantics so request input can no longer preempt it. Filters that integrators set server-side — TypoScript plugin.tx_solr.search.query.filter., plugin/FlexForm, or PSR-14 events — are unaffected.

Impact for integrators: a frontend request can no longer override siteHash (or access) through tx_solr[additionalFilters]. Cross-site search must be configured server-side via plugin.tx_solr.search.query.allowedSites as documented in tx_solr.search.

!!! Security: detail view enforces site and access restrictions (CVE-2026-56093) 

The detail action of the pi_results plugin looked up a document by its documentId without applying the current site's siteHash filter or the frontend user-group access filter. An anonymous visitor who knew or guessed a valid documentId could therefore retrieve access-restricted documents through the detail view — a path that was less restricted than the regular search.

The direct documentId lookup now applies the same siteHash and frontend user-group filters as the normal search path. A documentId that resolves to no accessible document — unknown, from another site, or restricted for the current visitor — yields the site's configured 404 page. The response is uniform, so it cannot be used to probe whether a restricted document exists.

As defence in depth, review whether your templates still expose data-document-id and mask it where the document id should not be publicly visible.

!!! Security: page indexer no longer forges access fields on page records (CVE-2026-56092) 

During a page-indexer sub-request, EXT:solr forced fe_group and extendToSubpages to public values on every pages record it touched, so the indexer itself would not be blocked by access restrictions.

On TYPO3 12 that override was applied where TYPO3 Core discards it again, so it never reached the shared rootline cache and no access bypass resulted. On TYPO3 13 the same override was persisted, letting anonymous visitors reach pages restricted only by an ancestor page's extendToSubpages.

The indexer no longer forges these fields. The access bypass it needed during indexing was already provided safely, without touching any persisted cache, by EXT:solr's other, unaffected listeners.

All Changes 

• [TASK] Remove guzzlehttp/psr7 <2.10.0 pin (upstream fix in guzzlehttp/guzzle 7.10.2) by @dkd-kaehm in #4660

All Changes 

• [BUGFIX] Pin guzzlehttp/psr7 to <2.10.0 by @dkd-kaehm in #4663
• [BUGFIX] facet URL encoding mismatch (spaces) when using urlParameterStyle=assoc by @dkd-hauser in #4625
• [BUGFIX] Correct field name casing for subTitle and navTitle in TypoScript queryFields by @amirarends in #4623
• [TASK] Upgrade GitHub Actions to latest versions by @dkd-kaehm in #4600
• [BUGFIX] Cast result offset to integer by @SaschaNoLe in #4584
• [TASK] fix CS 2026.03.08 by @dkd-kaehm in #4579
• [BUGFIX] pass a request with page id to Configuration manager by @WebsiteDeveloper in #4579
• [BUGFIX] Add checks for flexParentDatabaseRow key in methods by @Myrmod in #4579

!!! Upgrade to Apache Solr 9.10.1 

Apache Solr 9.10.1 fixes several security issues, please upgrade your Apache Solr instance!

• CVE-2025-54988: Apache Solr extraction module vulnerable to XXE attacks via XFA content in PDFs
• CVE-2026-22444: Apache Solr: Insufficient file-access checking in standalone core-creation requests
• CVE-2026-22022: Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin

New in this release 

Key Highlights 

1. Initial Vector Search Introduction:

   • The EXT:solr version 12.1 and 13.1 introduces an initial vector search option as a new search variant.
   • Activating this feature automatically generates vectors during indexing and frontend search.
   • A connected large language model (LLM) is required for operation, though it is not directly related to EXT:solr.

2. Handling and Limitations of Vector Search:

   • Current implementation includes limitations, especially in error handling when required LLMs are not defined, leading to potential impairments in indexing or search.
   • Indexing without vector calculation results in documents not being found despite successful index status.
   • A missing or unavailable LLM during search attempts can lead to a SolrInternalServerErrorException, returning an HTTP status 500.

3. Configuring a Large Language Model:

   • To use vector search, a large language model must be connected to encode text into vectors.
   • Configuration details are available in the Apache Solr Reference Guide 9.9.

   • Models can be uploaded using a JSON file and cURL command.

     Example configuration for the JSON file

     {
       "class": "dev.langchain4j.model.openai.OpenAiEmbeddingModel",
       "name": "llm",
       "params": {
         "baseUrl": "https://api.openai.com/v1",
         "apiKey": "apiKey-openAI",
         "modelName": "text-embedding-3-small",
         "timeout": 5,
         "logRequests": true,
         "logResponses": true,
         "maxRetries": 2
       }
     }

     Copied!
   • The number of dimensions for vectors defaults to 768 but can be adjusted via the SOLR_VECTOR_DIMENSION environment variable.

Future Developments 

• Improved Error Handling: Future versions plan to enhance error handling during vector indexing and search to increase robustness and reliability.
• Additional Query Types: New query types such as vector sorting and vector re-ranking are planned, allowing for more advanced search result manipulation.
• Backend Module for LLM Management: A backend module for managing large language models is anticipated, simplifying maintenance and configuration for developers.

This introduction marks a significant advancement for TYPO3's search capabilities by integrating AI technologies, with ongoing improvements and features planned for future releases.

For more detailed technical implementation and setup instructions, users should refer to the version 12.1 or 13.1 release notes and the associated documentation sections.

Technical insights 

As soon as vector search is enabled, EXT:solr will use the connected LLM to generate vectors during indexing and for each search in the frontend. During indexing vectors are generated based on field vectorContent which is by default filled with the contents of the content field. TypoScript indexing configurations can be used to customize the contents of the vectorContent field, e.g.:

plugin.tx_solr.index.queue.news.fields {
  vectorContent = SOLR_CONTENT
  vectorContent.cObject = COA
  vectorContent.cObject {
    10 = TEXT
    10 {
      field = name
    }

    15 = TEXT
    15 {
      field = bodytext
    }
  }
}

During indexing vectors will be created and stored in field vector.

All Changes 

• [FEATURE] Add DenseVectorField in schemas by @dkd-kaehm in #4440
• [TASK] Prepare release-12.1.x branch by @dkd-kaehm in #4445
• [TASK] 12.1.x-dev Update solarium/solarium requirement from 6.3.7 to 6.4.1 by @dependabot[bot] in #4434
• [FEATURE] Initial vector search by @dkd-friedrich in #4447
• [TASK] 12.1.x-dev Bump solr from 9.9.0 to 9.10.0 in /Docker/SolrServer by @dependabot[bot] in #4463
• Fix bug for phrase search with slops, bigram and trigram by Florian Rival in #4472
• [BUGFIX] Pass TypoScript configuration to SolrWriteService by @dkd-friedrich in #4475
• [FEATURE] Add dateRange field type in schema by @tillhoerner in #4487
• [BUGFIX] Replace TSFE call for page type by Sebastian Klein in #4488
• [FEATURE] Improve BeforeSearchFormIsShownEvent by Simon Schaufelberger in #4486
• [FEATURE] Add HEALTHCHECK to Dockerfile by @dkd-kaehm in #4489
• !!![FEATURE] allow nested TypoScript on multiValue fields by @dkd-kaehm in #4496